CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with Accompanying CVE-2026-19489 Memory Overflow (CVSS 8.8)

CVE-2026-19490 (TL-2026-2080) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-08-20 and last reviewed 2026-09-12. It has no confirmed attribution, affects Cloud Software Group (Citrix) NetScaler ADC, references 2 CVEs (CVE-2026-19490, CVE-2026-19489), maps to 38 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 45 indicators of compromise.

Key facts for TL-2026-2080

Threat ID
TL-2026-2080
Severity
CRITICAL
CVSS
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-20
Last reviewed
2026-09-12
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, education, technology, defense, energy, retail
Target regions
Global
Detection rules
9
Indicators of compromise
45
Updates
2026-09-12 · 4 updates · revalidated 4× · latest source

Malware and tooling in CVE-2026-19490

Malware and tooling: Rapid7, Web shells on NetScaler appliance filesystem

Two critical vulnerabilities disclosed August 19, 2026 in Citrix NetScaler ADC and NetScaler Gateway: CVE-2026-19490 (CVSS 9.3) is an unauthenticated remote authentication bypass via alternate path (CWE-288) affecting appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, allowing full compromise of confidentiality, integrity, and availability. CVE-2026-19489 (CVSS 8.8) is a memory overflow (CWE-119) enabling remote unauthenticated DoS when SIP ALG is enabled on LSN configurations. Cloud Software Group released patches across all affected build lines. Neither vulnerability has confirmed active exploitation as of August 20, 2026, but Citrix has a well-documented history of rapid weaponization — 22 prior Citrix CVEs on CISA KEV, 6 abused in ransomware attacks.

How CVE-2026-19490 works

On August 19, 2026, Cloud Software Group (Citrix) published security bulletin CTX696939 disclosing two vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances.

CVE-2026-19490 (CVSS 9.3, Critical) — Authentication Bypass via Alternate Path Discovered by Samarth Vashisht of JPMorgan Chase's penetration-testing team, this flaw allows a remote, unauthenticated attacker to circumvent authentication controls on vulnerable NetScaler appliances. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) — meaning the request handler has multiple code paths for processing incoming authentication requests, and one or more of these paths either fails to invoke the authentication verification routine or invokes it with attacker-controlled parameters that short-circuit the check. This is not a SAML assertion forgery or signature bypass; it is a routing/path confusion issue where the NetScaler treats the request as authenticated and grants access to the protected virtual server (SSL VPN portal, ICA Proxy, CVPN, RDP Proxy).

Preconditions vary by build version. On builds 14.1-43.56+ and 13.1-61.28+, both a configured SAML action AND a Gateway/AAA vserver are required. On earlier builds (14.1-43.55 and earlier, 13.1-61.27 and earlier, and all 13.1-FIPS), any Gateway or AAA virtual server configuration is sufficient — no SAML required. The CISA-ADP SSVC assessment rates the vulnerability Automatable (yes) with Technical Impact (total), meaning it can be reliably automated for full compromise.

CVE-2026-19489 (CVSS 8.8, High) — Memory Overflow A separate memory overflow (CWE-119/CWE-120) in the SIP Application Layer Gateway (ALG) feature when configured within a Large Scale NAT (LSN) group. The attacker can trigger unpredictable behavior or denial of service remotely without authentication. Requires the presence of SIP ALG in the configuration (detectable via 'add lsn group.*sipalg.*'). The CISA-ADP assessment rates it Automatable (yes) with Technical Impact (partial), meaning automated exploitation produces partial availability loss.

Both vulnerabilities affect NetScaler ADC and Gateway 14.1 before build 73.32 and 13.1 before build 63.21, including FIPS and NDcPP variants and Secure Private Access (formerly Citrix Secure Private Access) Hybrid deployments. No workarounds exist for either CVE — the only remediation path is upgrading to patched builds. Cloud Software Group's managed cloud services and Adaptive Authentication were already patched proactively.

As of publication, no active exploitation, public PoC code, or campaign-specific IOCs had been observed by Rapid7, Citrix, or CISA. However, Citrix NetScaler appliances are high-value perimeter targets: ShadowServer tracks over 22,000 NetScaler ADC and ~1,800 NetScaler Gateway instances exposed online. Citrix has a well-documented history of rapid exploitation — CISA has listed 22 Citrix CVEs as exploited in the wild over five years, with 6 of those abused in ransomware attacks. Two prior 2026 CVEs (CVE-2026-3055, CVE-2026-4368, patched March 23) were exploited within days of disclosure; CISA added CVE-2026-3055 to KEV on March 30. The historical exploitation of Citrix authentication-related vulnerabilities — including CVE-2023-3519 (CVSS 9.8, exploited as zero-day in June 2023 leading to webshell implantation, root-level access, Active Directory enumeration, and credential dumping) and CVE-2023-4966 "Citrix Bleed" (CVSS 9.4, exploited by LockBit 3.0 ransomware affiliates for session hijacking and MFA bypass starting August 2023) — establishes a clear threat pattern where NetScaler perimeter access is aggressively weaponized once public disclosure occurs.

MITRE ATT&CK techniques used in TL-2026-2080

Credential Access

T1003 OS Credential Dumping; T1212 Exploitation for Credential Access; T1556 Modify Authentication Process; T1606.002 Forge Web Credentials: SAML Tokens

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1021.001 Remote Services: Remote Desktop Protocol; T1210 Exploitation of Remote Services

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts; T1211 Exploitation for Defense Evasion

Discovery

T1046 Network Service Discovery; T1087 Account Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1136 Create Account; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588 Obtain Capabilities; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1590 Gather Victim Network Information; T1590.005 Gather Victim Network Information: IP Addresses; T1592.002 Gather Victim Host Information: Software; T1595.001 Active Scanning: Scanning IP Blocks; T1595.002 Active Scanning: Vulnerability Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-19490

  • Cloud Software Group (Citrix) — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-73.32; 13.1 before 13.1-63.21; 14.1 FIPS before 14.1-73.32 FIPS; 13.1 FIPS before 13.1-37.277; 13.1 NDcPP before 13.1-37.277
    Fixed in: 14.1-73.32 (or later); 13.1-63.21 (or later); 14.1-73.32 FIPS (or later); 13.1-37.277 (or later)
  • Cloud Software Group (Citrix) — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-73.32; 13.1 before 13.1-63.21
    Fixed in: 14.1-73.32 (or later); 13.1-63.21 (or later)
  • Cloud Software Group (Citrix) — Secure Private Access Hybrid
    Vulnerable versions: Customer-managed NetScaler deployments
    Fixed in: Same as NetScaler ADC/Gateway fixed builds

Remediation for CVE-2026-19490

Patches

  • NetScaler ADC/Gateway 14.1-73.32 (or later)
  • NetScaler ADC/Gateway 13.1-63.21 (or later)
  • NetScaler ADC FIPS 14.1-73.32 FIPS (or later)
  • NetScaler ADC FIPS / NDcPP 13.1-37.277 (or later)

Immediate actions

  • Upgrade NetScaler ADC/Gateway 14.1 to build 14.1-73.32 or later
  • Upgrade NetScaler ADC/Gateway 13.1 to build 13.1-63.21 or later
  • Upgrade NetScaler ADC FIPS 14.1 to build 14.1-73.32 FIPS or later
  • Upgrade NetScaler ADC FIPS / NDcPP 13.1 to build 13.1-37.277 or later
  • Identify and patch Secure Private Access Hybrid deployments with customer-managed NetScaler instances
  • Preserve appliance logs BEFORE patching for forensic review of potential prior compromise

Workarounds

  • No configuration-based workarounds exist — patching is the only mitigation
  • If patching is temporarily impossible, restrict management interfaces and Gateway/AAA virtual server access to trusted IP ranges via network ACLs
  • Disable SAML actions on Gateway/AAA vservers if business allows (reduces but does not eliminate attack surface on older builds)
  • Disable SIP ALG on LSN configurations to eliminate CVE-2026-19489 exposure

Longer-term hardening

  • Implement network segmentation around NetScaler appliances to limit blast radius of perimeter compromise
  • Deploy vendor-agnostic behavioral detection on NetScaler audit logs (aaad.debug, httpaccess.log)
  • Establish rapid patch SLA (<48 hours) for all perimeter appliance vulnerabilities
  • Treat remote access infrastructure as a compromised-zone boundary — never assume inherent trust
  • Map all applications, identities, privileged systems, and network segments reachable through NetScaler Gateways
  • Monitor CISA KEV catalog for future addition of these CVEs

CVEs associated with CVE-2026-19490

CVE-2026-19490, CVE-2026-19489

Weaknesses (CWE) in CVE-2026-19490

CWE-288, CWE-119, CWE-120

Timeline of CVE-2026-19490

Showing the 20 most recent tracked events.

  • Rapid7 ships detection content for CVE-2026-19490 in its InsightIDR/InsightVM August 20, 2026 content release.
  • TL-Intel Harness processes CVE-2026-19490/CVE-2026-19489 as threat TL-2026-2080; no confirmed active exploitation as of this date
  • ShadowServer reports over 22,000 NetScaler ADC and ~1,800 NetScaler Gateway instances exposed online, though not all are necessarily vulnerable to these specific CVEs
  • CISA-ADP assigns CWE-288 to CVE-2026-19490 and CWE-120 to CVE-2026-19489 on NVD entries
  • BleepingComputer and eSecurity Planet publish articles; NHS UK issues cyber alert CC-4834; SOC Prime publishes technical analysis with detection guidance
  • CISA-ADP adds SSVC assessment: CVE-2026-19490 rated Automatable (yes) and Technical Impact (total); CVE-2026-19489 rated Automatable (yes) and Technical Impact (partial); neither on KEV as exploitation=none
  • SecurityWeek publishes 'Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler,' predicting imminent weaponization given NetScaler's high-value, internet-facing profile.
  • As of this date, CVE-2026-19490 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and no public proof-of-concept exploit code has surfaced.
  • Help Net Security reports that NetScaler Console 14.1-60.52+/13.1-63.16+ customers can apply signature-based Global Deny List mitigations as an interim, non-patch control.
  • Third-party detection guidance notes the exact CVE-2026-19490 exploitation HTTP request has not been publicly documented and recommends behavioral hunting for sessions established without a corresponding successful authentication event.
  • TarPeg007 publishes a working proof-of-concept exploit and root-cause analysis for CVE-2026-19490 on GitHub, including a Python script with check-only and full exploitation-chain modes.
  • Previdian founder Ryan Dewhurst reports PoC-matching requests against CVE-2026-19490 from source IPs geolocated to Australia, the United States and Germany, cautioning this evidences exploitation attempts but not confirmed compromise.
  • Previdian's NetScaler sensor records its first request matching a publicly circulating CVE-2026-19490 proof-of-concept at 11:28 UTC.
  • Bishop Fox publishes technical analysis ('Mind the Config') detailing the SAML HTTP-Redirect binding/RelayState root cause, configuration-dependent impact chains (dead-end session, SSRF proxy, root via NITRO API), and releases a public detection tool (BishopFox/CVE-2026-19490-check).
  • BleepingComputer publishes reporting on the active exploitation of CVE-2026-19490, citing Previdian's sensor telemetry, the CCB Belgium warning, and Shadowserver's exposure counts.
  • The Centre for Cybersecurity Belgium (CCB/NCC-BE) issues a public advisory warning of active CVE-2026-19490 exploitation attempts and urging organizations to prioritize patching.
  • Previdian's observation window for CVE-2026-19490 closes at 03:30 UTC, having logged 10 total exploitation attempts from 6 unique source IPs across Australia, Germany, Japan and the United States on a single sensor.
  • Exploitation activity intensifies; Previdian records dozens of additional probe attempts (36 in a single day, 56 total since 2026-09-03) from source IPs across at least six countries (Australia, Germany, Japan, Romania, Taiwan, United States).
  • CISA adds CVE-2026-19490 to its Known Exploited Vulnerabilities catalog as the 'Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability,' setting a federal remediation deadline of 2026-09-12 under BOD 26-04.
  • CISA's federal civilian remediation deadline for CVE-2026-19490 arrives; NCSC's weekly 'CTO at NCSC' summary flags the CVE as having exploitation available.

Update history for TL-2026-2080

Sources cited for CVE-2026-19490

Threats related to CVE-2026-19490

Detection coverage for TL-2026-2080

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2080 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats